Emails not working after upgrade: certificate verify failed

AI-generated summary

After upgrading Discourse from 2.8 (beta) to 2.9 (beta), pratyushmittal reports that email sending via their self-hosted SMTP server has stopped working. The ./discourse-doctor tool returns an SSL error: certificate verify failed (self signed certificate). Previously, they encountered EE certificate key too weak, which they resolved by regenerating OpenSSL certificates — but the new error persists. They note that the same SMTP server and settings worked without issue for years prior to the upgrade, suggesting v2.9 introduced stricter SSL validation. JammyDodger links to a related discussion on Meta Discourse that may offer guidance: email hostname certificate mismatch causing sidekiq queue overload. The user seeks advice on how to resolve the SSL certificate verification failure in the new version.

We use our own SMTP server for sending emails. It has been working fine with Discourse for the last few years.

We recently updated Discourse from 2.8 (beta) to 2.9 (beta). We are unable to send the emails now.

Output of ./discourse-doctor:

==================== MAIL TEST ====================
For a robust test, get an address from http://www.mail-tester.com/
Or just send a test message to yourself.
Email address for mail test? ('n' to skip) [REDACTED]: REDACTED
Sending mail to REDACTED. . .
Testing sending to REDACTED using 13.235.xxx.xxx:25, username:REDACTED with login auth.
======================================== ERROR ========================================
                                    UNEXPECTED ERROR

SSL_connect returned=1 errno=0 state=error: certificate verify failed (self signed certificate)

====================================== SOLUTION =======================================
This is not a common error. No recommended solution exists!

Please report the exact error message above to https://meta.discourse.org/
(And a solution, if you find one!)
=======================================================================================

Earlier we got another error: certificate verify failed (EE certificate key too weak). We regenerated the OpenSSL certificates on our email server. Now we are getting this error.

This same server with the same settings was working fine for the last couple of years. Something in v2.9 (beta) has made the SMTP SSL connect stricter.

How can I navigate this? Any leads will be very helpful.

There’s some discussion and advice about a similar error in this recent topic that may be helpful :crossed_fingers: